Reply to thread

Message

<blockquote data-quote="LaurentG" data-source="post: 935329" data-attributes="member: 91050">OK, thanks for your answer.Like in your own testing, in my case also Defender often did not show the alert on AMSI based detections, only sometimes (I&#039;d say once out of 3 or 4)And when it&#039;s the case, I got the same messages (except they&#039;re in french <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />).If you allow (as shown in your screen copy), what I understand and what I experimented is that after excluding this detection, this threat will be allowed for other scripts. While you write (in the other thread) : it does not mean that after excluding this detection, the blocked script code (like &quot;Wshshell.run&quot;) will be allowed for other scripts. It is an important feature because otherwise, such exclusions would decrease the protection.I fully agree with your conclusion about decrease of protection that could generate.... So the (very important) question is :If we exclude the threat (as you show it just above, and as I did it), will this threat Trojan:VBS/Mountsi.A!ml be allowed for other scripts ?As I write above, my personal experience is that the answer is Yes (after allowing it, I never got it anymore, not only running the original script, but even in slightly modified copies of the original script, that BOTH raised this detection before allowing the threat, until I remove the allowance/Exclusion).And if I&#039;m right, as you say &quot;such exclusions would decrease the protection.&quot;But maybe I&#039;m wrong ? Are you sure that this exclusion do not have such consequence ?Thanks in advanced for your advice !</blockquote>

[QUOTE="LaurentG, post: 935329, member: 91050"] OK, thanks for your answer. Like in your own testing, in my case also Defender often did not show the alert on AMSI based detections, only sometimes (I'd say once out of 3 or 4) And when it's the case, I got the same messages (except they're in french ;)). If you allow (as shown in your screen copy), what I understand [U][B][U]and what I experimented[/U] [/B][/U]is that[B] after excluding this detection, this threat will be allowed for other scripts. [/B] While you write (in the other thread) : [U][I][U]it does not mean[/U][/I][/U][B][I][B] that after excluding this detection, the blocked script code (like "Wshshell.run") [/B][/I][/B][I][U]will be allowed[/U] for other scripts[/I][B][I][B].[/B][/I][/B][I] [U]It is an important feature because otherwise, such exclusions would decrease the protection.[/U][/I] [B]I fully agree with your conclusion about decrease of protection that could generate.... [/B] So the ([B][U]very important[/U][/B]) question is : If we exclude the threat (as you show it just above, and as I did it), [U][B][U]will this threat Trojan:VBS/Mountsi.A!ml be allowed for other scripts ?[/U][/B][/U] As I write above, my personal experience is that the answer is Yes (after allowing it, I [U][B]never [/B][/U]got it anymore, not only running the original script, but even in slightly modified copies of the original script, that BOTH raised this detection before allowing the threat, until I remove the allowance/Exclusion). And if I'm right, as you say "such exclusions would decrease the protection." But maybe I'm wrong ? [B]Are you sure that this exclusion do not have such consequence ? Thanks in advanced for your advice ![/B] [/QUOTE]

Verification